Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
CallLogAnalyzer.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.iOS;
20 
21 import java.sql.Connection;
22 import java.sql.DriverManager;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.util.List;
27 import java.util.logging.Level;
28 import org.openide.util.NbBundle.Messages;
40 
41 class CallLogAnalyzer {
42 
43  private Connection connection = null;
44  private ResultSet resultSet = null;
45  private Statement statement = null;
46  private String dbPath = "";
47  private long fileId = 0;
48  private java.io.File jFile = null;
49  private String moduleName = iOSModuleFactory.getModuleName();
50  private static final Logger logger = Logger.getLogger(CallLogAnalyzer.class.getName());
51  private Blackboard blackboard;
52 
53  public void findCallLogs(IngestJobContext context) {
54  blackboard = Case.getCurrentCase().getServices().getBlackboard();
55  List<AbstractFile> absFiles;
56  try {
58  absFiles = skCase.findAllFilesWhere("name ='contacts2.db' OR name ='contacts.db'"); //NON-NLS //get exact file names
59  if (absFiles.isEmpty()) {
60  return;
61  }
62  for (AbstractFile AF : absFiles) {
63  try {
64  jFile = new java.io.File(Case.getCurrentCase().getTempDirectory(), AF.getName().replaceAll("[<>%|\"/:*\\\\]", ""));
65  ContentUtils.writeToFile(AF, jFile, context::dataSourceIngestIsCancelled);
66  dbPath = jFile.toString(); //path of file as string
67  fileId = AF.getId();
68  findCallLogsInDB(dbPath, fileId);
69  } catch (Exception e) {
70  logger.log(Level.SEVERE, "Error parsing Call logs", e); //NON-NLS
71  }
72  }
73  } catch (TskCoreException e) {
74  logger.log(Level.SEVERE, "Error finding Call logs", e); //NON-NLS
75  }
76  }
77 
78  @Messages({"CallLogAnalyzer.indexError.message=Failed to index call log artifact for keyword search."})
79  private void findCallLogsInDB(String DatabasePath, long fId) {
80  if (DatabasePath == null || DatabasePath.isEmpty()) {
81  return;
82  }
83  try {
84  Class.forName("org.sqlite.JDBC"); //NON-NLS //load JDBC driver
85  connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
86  statement = connection.createStatement();
87  } catch (ClassNotFoundException | SQLException e) {
88  logger.log(Level.SEVERE, "Error opening database", e); //NON-NLS
89  }
90 
91  Case currentCase = Case.getCurrentCase();
92  SleuthkitCase skCase = currentCase.getSleuthkitCase();
93  try {
94  AbstractFile f = skCase.getAbstractFileById(fId);
95  if (f == null) {
96  logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
97  return;
98  }
99 
100  try {
101  resultSet = statement.executeQuery(
102  "SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;"); //NON-NLS
103 
104  BlackboardArtifact bba;
105  String name; // name of person dialed or called. null if unregistered
106  String number; //string phone number
107  String duration; //duration of call in seconds
108  String date; // Unix time
109  String type; // 1 incoming, 2 outgoing, 3 missed
110 
111  while (resultSet.next()) {
112  name = resultSet.getString("name"); //NON-NLS
113  number = resultSet.getString("number"); //NON-NLS
114  duration = resultSet.getString("duration"); //NON-NLS
115  date = resultSet.getString("date"); //NON-NLS
116  type = resultSet.getString("type"); //NON-NLS
117 
118  bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG); //create a call log and then add attributes from result set.
119  if (type.equalsIgnoreCase("outgoing")) { //NON-NLS
121  } else {
123  }
124  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, moduleName, date)); // RC: Should be long!
125  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END, moduleName, duration + date)); // RC: Should be long!
128 
129  try {
130  // index the artifact for keyword search
131  blackboard.indexArtifact(bba);
132  } catch (Blackboard.BlackboardException ex) {
133  logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bba.getArtifactID(), ex); //NON-NLS
135  Bundle.CallLogAnalyzer_indexError_message(), bba.getDisplayName());
136  }
137  }
138  } catch (Exception e) {
139  logger.log(Level.SEVERE, "Error parsing Call logs to the Blackboard", e); //NON-NLS
140  } finally {
141  try {
142  resultSet.close();
143  statement.close();
144  connection.close();
145  } catch (Exception e) {
146  logger.log(Level.SEVERE, "Error closing the database", e); //NON-NLS
147  }
148  }
149  } catch (Exception e) {
150  logger.log(Level.SEVERE, "Error parsing Call logs to the Blackboard", e); //NON-NLS
151  }
152 
153  }
154 
155 }
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
AbstractFile getAbstractFileById(long id)
void addAttribute(BlackboardAttribute attr)
BlackboardArtifact newArtifact(int artifactTypeID)
synchronized void indexArtifact(BlackboardArtifact artifact)
Definition: Blackboard.java:59
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.